Analysis

  • max time kernel
    145s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-06-2022 06:36

General

  • Target

    3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a.exe

  • Size

    361KB

  • MD5

    1e4e3ab0d662c3f8a47c67ed427a154f

  • SHA1

    c96cf36141dd1a2a88bcaf3881f233a40854fb2b

  • SHA256

    3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a

  • SHA512

    879ac733fc2cfd57561ce65a92bab41d47484da3b7e7e2c430359bfa0301f1f3fcf253d181ed1bc7fbf20861b35cdc871acc9cf461909e69936fadaa58c4936e

Malware Config

Extracted

Family

gozi_ifsb

Botnet

1010

C2

diuolirt.at

deopliazae.at

nifredao.com

filokiyurt.at

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1312
    • C:\Users\Admin\AppData\Local\Temp\3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a.exe
      "C:\Users\Admin\AppData\Local\Temp\3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AD14\568A.bat" "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\3A25AC~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\3A25AC~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1736
          • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
            "C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe" "C:\Users\Admin\AppData\Local\Temp\3A25AC~1.EXE"
            5⤵
            • Executes dropped EXE
            • Deletes itself
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1228
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AD14\568A.bat
    Filesize

    108B

    MD5

    66357986ca32c520667f9434c6ebeaf3

    SHA1

    3b6f8286a7685a44630c2657b01ac3b234cda755

    SHA256

    3be0d761f54fbe8b45d22e07cf77da245bb59c78c18c055e4e76685a98ebec25

    SHA512

    16aac55744f9cac7449b77c9cac15456645208d91f826206814181e3d13cda4f7e60bd0e7323e1e5d851332e41456a1c24927bd372b2bceb650beb6ebf5b7f2a

  • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    361KB

    MD5

    1e4e3ab0d662c3f8a47c67ed427a154f

    SHA1

    c96cf36141dd1a2a88bcaf3881f233a40854fb2b

    SHA256

    3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a

    SHA512

    879ac733fc2cfd57561ce65a92bab41d47484da3b7e7e2c430359bfa0301f1f3fcf253d181ed1bc7fbf20861b35cdc871acc9cf461909e69936fadaa58c4936e

  • C:\Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    361KB

    MD5

    1e4e3ab0d662c3f8a47c67ed427a154f

    SHA1

    c96cf36141dd1a2a88bcaf3881f233a40854fb2b

    SHA256

    3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a

    SHA512

    879ac733fc2cfd57561ce65a92bab41d47484da3b7e7e2c430359bfa0301f1f3fcf253d181ed1bc7fbf20861b35cdc871acc9cf461909e69936fadaa58c4936e

  • \Users\Admin\AppData\Roaming\bitsmuid\ACCTient.exe
    Filesize

    361KB

    MD5

    1e4e3ab0d662c3f8a47c67ed427a154f

    SHA1

    c96cf36141dd1a2a88bcaf3881f233a40854fb2b

    SHA256

    3a25ac74307f2358212c1cf753a9ae3ff548737ee6c6c0a789ca07464038bb5a

    SHA512

    879ac733fc2cfd57561ce65a92bab41d47484da3b7e7e2c430359bfa0301f1f3fcf253d181ed1bc7fbf20861b35cdc871acc9cf461909e69936fadaa58c4936e

  • memory/1228-63-0x0000000000000000-mapping.dmp
  • memory/1228-66-0x0000000000400000-0x000000000045D000-memory.dmp
    Filesize

    372KB

  • memory/1228-68-0x0000000000270000-0x00000000002A0000-memory.dmp
    Filesize

    192KB

  • memory/1312-71-0x00000000029B0000-0x0000000002A25000-memory.dmp
    Filesize

    468KB

  • memory/1312-72-0x00000000029B0000-0x0000000002A25000-memory.dmp
    Filesize

    468KB

  • memory/1620-57-0x0000000000230000-0x0000000000260000-memory.dmp
    Filesize

    192KB

  • memory/1620-54-0x0000000075951000-0x0000000075953000-memory.dmp
    Filesize

    8KB

  • memory/1620-55-0x0000000000400000-0x000000000045D000-memory.dmp
    Filesize

    372KB

  • memory/1708-69-0x0000000000000000-mapping.dmp
  • memory/1708-70-0x0000000000230000-0x00000000002A5000-memory.dmp
    Filesize

    468KB

  • memory/1728-58-0x0000000000000000-mapping.dmp
  • memory/1736-60-0x0000000000000000-mapping.dmp